Security warnings circulating this week about a malicious iPhone Safari attack have prompted renewed calls for iOS updates—particularly over fears that the exploit could be used to steal crypto wallet secrets. However, SlowMist says it has not yet confirmed a real victim whose device was compromised by the specific Safari sample it analyzed, and it cautions that the initially reported iOS versions affected may be wider than what is technically proven.

In an investigation shared with Cointelegraph, SlowMist said the strongest evidence it has supports impact on iOS 18.4 through iOS 18.6.2, while an oft-cited “iOS 13 to 26.5” range should be treated as preliminary until reproducible proof is available. The firm also highlighted that the Safari campaign reuses techniques from the previously disclosed DarkSword iOS exploit chain, and that it is separate from another SlowMist case involving a malicious component embedded in an App Store application tied to the FomoPeek investigation.

Key takeaways

• SlowMist has not independently confirmed a crypto theft or a specific confirmed victim tied to the exact Safari sample it examined.
• The firm’s strongest technical evidence points to iOS versions 18.4 through 18.6.2; broader iOS coverage reported elsewhere is not yet proven.
• The malicious webpage was designed to trigger an exploit via Safari and, once accessed, target Apple Keychain data and other app storage.
• SlowMist links the Safari techniques to DarkSword reuse, while emphasizing this Safari campaign is distinct from its earlier FomoPeek App Store-related investigation.
• SlowMist continues to recommend installing the latest iOS security updates and taking additional precautions such as Apple’s Lockdown Mode and rotating wallet credentials on suspected exposure.

Why the Safari warning is still urgent

The core claim behind the current wave of warnings is that a malicious Safari page could expose crypto private keys and seed phrases. While SlowMist’s analysis supports that the sample includes functionality aimed at collecting sensitive information, it draws a clear line between “capability” and “confirmed success against a particular wallet on a real device.”

SlowMist told Cointelegraph that it has not independently confirmed a victim compromise tied specifically to the Safari attack sample it studied. The company further noted that its investigation did not execute the full exploit chain on a real victim device, limiting the ability to identify an actual endpoint where secrets were successfully extracted.

That distinction matters for both users and defenders: even without confirmed theft, the presence of a plausible collection mechanism is enough to justify immediate defensive steps—especially because seed phrases and private keys are once-off secrets that can’t be safely “partially” exposed.

DarkSword techniques reused in a WYINCC Safari campaign

SlowMist’s write-up ties the Safari attack’s underlying approach to DarkSword, an iOS exploit chain that was disclosed earlier by Google Threat Intelligence Group (GTIG) in March. According to GTIG, DarkSword had been used by multiple threat actors since at least November 2025.

Google’s disclosure described DarkSword as an iOS exploit chain, and SlowMist said its own threat intelligence team—led by its chief information security officer, 23pds—first identified relevant activity in early May. SlowMist then published its analysis of the WYINCC Safari campaign on Sept. 4.

In this campaign, SlowMist said the malicious webpage appeared to advertise a free virtual private server service. When opened on an iPhone using Safari, the page loaded exploit code. SlowMist’s description indicates that the page could trigger the malicious code without requiring an additional click beyond visiting the page.

Importantly for risk assessment, SlowMist said the vulnerabilities employed in the chain had already been disclosed and patched by Apple. That aligns with the practical takeaway for users: applying the latest iOS updates is the most reliable way to reduce exposure to known, patched weaknesses.

What the sample was built to target

Beyond the delivery mechanism, SlowMist focused on what the malicious Safari sample attempted to access. The firm said the sample included a component designed to interact with Apple’s Keychain and retrieve and decrypt information stored there.

SlowMist also said the code could access app files and shared app data—capabilities that may overlap with information stored by cryptocurrency wallet applications. At the same time, SlowMist stressed that this demonstrates collection capability and intended targets, but does not itself prove successful extraction from every targeted wallet.

In other words, the technical evidence suggests a route to sensitive data. But it doesn’t automatically establish that the exploit would work on every device running the affected versions, nor does it prove that any specific wallet compromise occurred in the wild for this exact sample.

SlowMist also cautioned that it did not run the complete chain on a real victim device, which prevented it from independently identifying a specific confirmed victim whose device was compromised by the exact Safari sample.

How SlowMist frames iOS version risk and what to do next

The most sensitive aspect of the reporting has been the breadth of iOS versions claimed to be affected. Some warnings circulating this week cited a wide range from iOS 13 through iOS 26.5. SlowMist told Cointelegraph it views that range as preliminary and prefers to avoid stating that iOS 26.5 is affected until there is reproducible technical evidence.

SlowMist said its strongest technical evidence covers iOS 18.4 through iOS 18.6.2. For users, the practical implication is straightforward even if the exact upper or lower bounds remain uncertain: anyone on an older iOS version should prioritize upgrading to the latest available security release.

SlowMist still recommended updating iOS and avoiding suspicious links. For users unable to update immediately—or those facing higher exposure risk—it pointed to Apple’s Lockdown Mode as an added defense, while also noting it has not confirmed that Lockdown Mode fully blocks this particular Safari attack.

Finally, SlowMist urged users who suspect their wallet key or seed phrase may have been exposed to move assets to a newly generated wallet created on a clean device, rather than continuing to rely on potentially compromised credentials.

With the iOS version scope still being refined and no confirmed victim tied to the exact sample yet established by SlowMist, the next phase to watch is whether further independent technical validation narrows the affected ranges and whether defenders see confirmed real-world compromises tied to the WYINCC Safari campaign.

Bitget CEO Gracy Chen has acknowledged that North Korea was likely responsible for the crypto exchange’s latest hack that stole roughly $352 million.

Substantial withdrawals were spotted from addresses labelled as Bitget hot and cold wallets yesterday, setting off alarm bells across the community.

Crypto investigator Specter Analyst linked the attack to North Korean hacking collective Lazarus Group.

Since then, Chen has confirmed in a livestream that the attack displays the signs of a North Korean operation.

Read more: How 4,000 BTC walked out of Blockstream’s Liquid Network

Chen also revealed that various chains have frozen addresses associated with the hack, and that the Bitget wallet, separate from the exchange, wasn’t affected.

She also ruled out the possibility of a private key compromise, and claimed hackers were able to breach the wallet services backend system, forge transfer details, and authorize their own signing processes.

Bitget’s cold wallets reportedly remained secure while their hot wallets and warm wallet layers were targeted.

Bitget CEO says users funds are covered

Chen claimed user funds were safe, with the majority of the loss covered by Bitget’s User Protection Fund, “which currently holds over $464 million.”

Bitget is now working with independent investigators Mandiant and SlowMist to fully determine what happened. It announced this morning that withdrawels are still temporarily paused.

The Bitget hack was initially expected to involve significantly lower losses, and unfortunately for Bitget, it took place as the exchange celebrated its eighth birthday.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

DoubleZero has launched a dedicated market data feed for Hyperliquid, aiming to give professional trading firms a more reliable and complete view of the decentralized exchange’s order book. The service delivers Hyperliquid’s market data over fiber, rather than relying on the exchange’s public APIs.

According to DoubleZero, the feed provides an ordered, continuous stream of order book data for market makers, quantitative traders, and proprietary trading firms that depend on consistent update frequency and depth.

Key takeaways

• DoubleZero’s Hyperliquid feed distributes full order book data via a dedicated fiber network instead of public APIs.
• The service supports Hyperliquid’s native perpetual futures and also markets run through trade[XYZ], a venue using Hyperliquid infrastructure for asset-linked perpetuals.
• DoubleZero says public API changes have reduced both the frequency and the depth of order book updates available to external consumers.
• The initiative broadens DoubleZero’s “Edge” market-data offering, which already includes Solana and the prediction market Kalshi.

A fiber-based order book for professional traders

For firms that need a full and timely order book, pulling liquidity data from a public interface can introduce inconsistency. DoubleZero’s new feed is designed to address that by providing market data as a continuous stream, with ordering guarantees intended to help automated systems interpret changes quickly and predictably.

DoubleZero positioned the launch around a practical problem: before this release, companies seeking a complete view of Hyperliquid’s order book typically had to reconstruct it themselves from public API responses or run their own Hyperliquid nodes. DoubleZero now offers a third path—an outsourced, purpose-built distribution layer.

The company also attributes the need for a dedicated feed to changes in Hyperliquid’s public APIs. DoubleZero said those updates have lowered the cadence and reduced the depth of information available through the public routes, making it harder for data consumers that require more frequent, comprehensive updates.

What’s included: native perps and Hyperliquid-powered markets

DoubleZero said the feed covers Hyperliquid’s native perpetual futures markets, alongside markets operated by trade[XYZ]. In this structure, trade[XYZ] provides perpetual contracts linked to assets including oil, gold, and silver, using Hyperliquid’s underlying infrastructure.

DoubleZero added that the feed was developed in collaboration with validator operators and ecosystem partners, including Hyperion DeFi, MAVAN, and Kinetiq. That matters because fiber-based delivery depends not just on software integration but also on reliable distribution pathways across network participants.

Why this matters: convergence with traditional exchange data workflows

The launch also highlights a broader trend in onchain market infrastructure: professional trading firms are increasingly looking for data distribution patterns similar to those used by large traditional exchanges.

Hyperion DeFi CEO Hyunsu Jung told Cointelegraph that major exchanges such as CME and Nasdaq distribute professional market data over dedicated networks. The point is to deliver a consistent stream of ordered information at high speeds to automated trading systems.

Jung argued that Hyperliquid’s market data can now be consumed through a similar model. In his words, the approach is effectively “publish once, distribute simultaneously over dedicated fiber,” echoing the logic behind how institutional infrastructure treats market data as a specialized distribution problem.

That said, Jung emphasized there are meaningful differences. Traditional exchanges allow firms to reduce latency further by placing trading infrastructure close to the venue’s execution systems. Hyperliquid, by contrast, executes trades onchain, which changes where latency is incurred and how it can be optimized.

He also noted that physical geography still matters. A firm based in Tokyo, for example, will maintain a speed advantage over one in New York regardless of how the data is delivered—an important reminder that fiber distribution can improve consistency and reduce certain bottlenecks, but it does not eliminate real-world network and distance effects.

Jung summarized the relationship as not a claim that Hyperliquid is becoming “CME,” but rather that onchain markets are borrowing the market-data infrastructure layer that professional firms already rely on in conventional finance.

Expanding “Edge” market data beyond crypto venues

DoubleZero’s Hyperliquid feed is the third venue available through its Edge market-data service. The company previously deployed similar services for Solana and for Kalshi, a prediction market. With this expansion, DoubleZero is effectively positioning Edge as a cross-venue distribution platform aimed at professional-grade data consumption.

For market makers and quantitative firms, the practical value of an Edge-style service is straightforward: fewer gaps in update streams, less reliance on reconstructing order books from partial public feeds, and a single distribution layer designed for automation.

For the broader Hyperliquid ecosystem, it may also signal a shift toward treating market data as critical infrastructure in its own right. Instead of forcing each data-heavy firm to build bespoke ingestion and normalization systems, venues can increasingly support dedicated distribution pipelines that align with how trading desks already operate.

Investors and traders will likely watch next how widely institutions adopt the feed and whether other onchain venues respond with similar dedicated distribution layers, particularly as more market participants push for predictable, ordered depth updates beyond what public APIs can provide.

Bitcoin’s recent surge has some traders liquidating the coins to take profits on their holdings. But the pace of this operation is far slower than at prior market peaks, a positive sign for the market.

BTC has rallied by 44% to nearly $85,000 this quarter, its best performance since the final three months of 2024, according to CoinDesk data. The strong rise comes after three straight quarters of red ink.

Naturally, some are taking profits, as evidenced by the net realized profit/loss metric. It records the dollar gains locked in when coins actually move on-chain at a price above the last price at which they changed hands.

Analysts treat that prior transfer as a cost basis: if a coin bought or last spent at $40,000 is later sent or sold at $84,000, the $44,000 difference is booked as realized profit.

“BTC holders just realised $2.4bn in profits. At prior market tops, daily realized profits ran between $7bn and $10bn,” Bitfinex said on X.

Ethena has added tokenized U.S. equities and equity perpetual futures to the basis trading strategy used for part of USDe’s backing, taking a funding model previously centered on crypto markets into listed stocks.

According to a statement shared with crypto.media, Ethena will use Binance’s bStocks as the spot side of the trade while taking offsetting positions through equity perpetual futures on the exchange.

The structure follows a framework previously approved by the Ethena Risk Committee for adding tokenized equity basis trades to the protocol’s allocation strategy. Ethena has historically used a delta neutral approach in crypto markets, pairing asset exposure with derivatives positions intended to hedge movements in the underlying asset.

Under the new setup, bStocks will provide tokenized equity exposure while Binance’s corresponding perpetual contracts will provide the hedge. The strategy seeks to capture the difference between the spot and perpetual markets without relying primarily on the direction of the underlying stock.

“This is the most significant expansion of USDe’s funding mechanism since we started,” Ethena Labs founder Guy Young said.

“Equities trade in the hundreds of trillions of dollars globally, and as more of that market moves onchain, we see a substantial opportunity to continue diversifying our backing strategy,” Young added.

How will Ethena use tokenized stocks for USDe?

Binance’s bStocks represent interests in securities held by issuer BTech Holdings Limited. Eligible users can convert the tokens into the corresponding securities through Binance where permitted by applicable laws.

The exchange launched its first bStocks in June with tokenized versions of Nvidia, Tesla, Circle, Micron and Sandisk. The assets are backed 1:1 by corresponding securities and can be converted between stock and tokenized form without conversion fees for eligible users.

Unlike direct share ownership, bStocks provide economic exposure to the linked securities without giving token holders the voting rights associated with owning the shares themselves.

Demand for the product grew quickly after its launch. By August, the value of Binance bStocks had reached roughly $610.6 million, putting the product ahead of xStocks as the second largest tokenized stock issuer in the dataset tracked by Token Terminal. Ondo Finance remained the largest issuer at the time.

Ethena plans to pair the tokenized assets with short positions in Binance equity perpetual futures. Gains or losses in the spot position can therefore be offset by movements in the derivatives position, leaving the funding or basis between the two markets as the main source of return.

Binance had more than $2.9 billion of open interest across equity perpetual futures based on figures provided by Ethena. Open interest in the products has grown at a compound monthly rate of 105% this year, while the equity basis averaged an annualized 3.56% during the past six months.

Ethena USDe backing moves beyond crypto basis trades

USDe’s backing model has already changed considerably as Ethena has added lending, stablecoin liquidity and tokenized real world assets alongside its original crypto basis positions.

Crypto.news previously reported that crypto basis positions accounted for roughly $39 million, or 1%, of USDe’s backing portfolio in early July. DeFi lending represented around 46%, while liquid stablecoins made up 35% and tokenized real world assets accounted for another 11.2%.

Institutional lending has become another part of the allocation. Ethena and FalconX launched a $1 billion facility in August that allows assets backing USDe to finance overcollateralized loans to institutional borrowers. FalconX originates and services the loans through a special purpose vehicle, while qualified custodians hold collateral worth more than the outstanding loans.

Institutional lending represented roughly $310 million, or 6.9%, of USDe backing in early July, according to Ethena governance data cited at the time.

Adding equities gives the protocol another market in which it can run the basis strategy that formed the original foundation of USDe. Ethena expects the opportunity in equity perpetuals to eventually become significantly larger than the corresponding crypto perpetual market.

Binance Head of Exchange and Trading Shunyet Jan said growing liquidity around bStocks and equity perpetuals was creating more use cases for both products.

“Ethena runs one of the largest systematic strategies in digital assets, and their expansion into tokenized securities and equity perps is a clear sign of how the convergence of crypto and traditional assets will surface new opportunities,” Jan said.

Binance equity markets provide the other side of the trade

Binance has spent much of 2026 building stock products alongside its crypto trading business, giving Ethena both tokenized spot instruments and derivatives within the same trading ecosystem.

The exchange opened access to more than 7,000 U.S. stocks and ETFs for eligible users outside the United States in June. Fractional purchases start at $5, while users can fund positions with USDT, USDC, BNB and selected cryptocurrencies.

bStocks followed later that month as the tokenized layer of the equity offering. Eligible holders can trade the assets around the clock and withdraw supported tokens to compatible self custody wallets.

Activity in Binance’s traditional finance derivatives business has grown alongside the spot offering. The exchange’s TradFi perpetual futures generated roughly $433.4 billion of trading volume during August, according to figures previously reported by The Block. Equity linked contracts accounted for approximately $342.9 billion of the total.

The exchange has continued building products around the same market. Binance recently said its Direct Stocks service crossed $1 billion in user held U.S. equities within 30 days of launch, while trading volume approached $3 billion over the period.

Equity perpetuals give traders leveraged exposure without requiring ownership of the underlying securities, while bStocks create tokenized representations tied to securities held by BTech Holdings. Ethena’s strategy uses the two sides together instead of treating them as separate directional trades.

Tokenized equities have grown across crypto platforms

Ethena’s allocation arrives as tokenized stocks have become one of the faster growing parts of the real world asset market.

Token Terminal data cited in August put the tokenized stock market it tracked at around $2.7 billion, compared with roughly $80 million a year earlier. Binance’s bStocks accounted for more than $600 million at the time, while Ondo Finance and xStocks represented other major issuers in the dataset.

Binance Research previously estimated that tokenized stocks had grown 422% as the wider tokenized real world asset market expanded during 2026. The firm said adoption would continue to depend on factors including regulation, custody, market depth and exchange support.

Traditional market products have meanwhile become a larger part of activity on crypto exchanges. Binance Research said TradFi linked perpetual contracts already represented roughly 10% of stablecoin trading volume earlier this year, with stablecoin settlement providing a route for users to trade traditional assets through existing crypto accounts.

Ethena’s equity allocation will operate within the risk framework approved by its Risk Committee, using tokenized spot positions and corresponding perpetual hedges as the protocol begins deploying its basis strategy outside crypto assets.

The divergence comes as government bond yields climb globally. The war in the Middle East has driven oil and diesel prices higher, complicating the inflation outlook and raising questions about how much further central banks may need to tighten policy. The U.S. 10-year Treasury yield briefly hit 5.2% on Thursday before easing to 5.163%.

When MOVE was last around this level in March, the S&P 500 stood near 6,350. It has since risen to 7,704, up roughly 21%. However, bond traders are now paying considerably more for protection against swings in interest rates.

Over a 20-day window, the correlation between VIX and MOVE has slipped to −0.06, turning negative for the first time since April 2024, though that reading is close to zero. The correlation between BVIV and MOVE is more clearly negative at −0.37, one of its lowest readings in years. As bond volatility has risen, bitcoin’s expected volatility has remained near its yearly low.

As CoinDesk reported this week, rising yields alone have shown little consistent relationship with bitcoin’s returns.